It is not difficult to see how one would achieve \((\varepsilon ,\delta )\) -DP
guarantees following Equation REF . To achieve \((\varepsilon ,\delta )\) -DP, typically \(\sigma \)  is in the order of \(\Omega (q\frac{\sqrt{T\log (\frac{1}{\delta })}}{\varepsilon })\)  [1]}. Moreover, Mironov et. al. [2]} showed tighter bounds for a given \(\sigma \) .
On each iteration,
we are computing a differentially-private update of the model parameters given the
gradient update \(\nabla _\theta \ell \)  through the subsampled Gaussian Mechanism.
Then, because DP is immune to post-processing, we can apply these gradients to
the model.
Finally, through composition, we can obtain a guarantee for the entire model training pipeline.
